CVE-2025-55634

Executive Summary

CVE-2025-55634 identifies a critical Denial of Service (DoS) vulnerability in the Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime, firmware version v3.0.0.4662_2503122283. The flaw resides in the RTMP server settings, where incorrect access control allows an unauthenticated attacker to initiate a large number of simultaneous ffmpeg-based stream pushes, overwhelming the device and causing a denial of service. This vulnerability is particularly concerning for IoT environments where doorbells are exposed to the internet or local networks without proper segmentation. No patch is currently available, and no public exploit code has been released, but the attack vector is straightforward and can be weaponized with minimal effort.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Threat Level: High (due to ease of exploitation and lack of patch)

Deep Dive & Mechanics

The Reolink Smart 2K+ doorbell runs an RTMP server to handle video streaming. The vulnerability stems from improper access control in the RTMP server settings, which fails to limit the number of concurrent stream pushes from a single source. An attacker can send multiple ffmpeg-based RTMP push requests simultaneously, exhausting the device's CPU, memory, and network bandwidth. This leads to a complete denial of service, rendering the doorbell unresponsive and unable to process legitimate video streams or other functions.

The attack does not require authentication, as the RTMP server accepts push requests without verifying the source. The ffmpeg tool is commonly used for streaming, making the exploit accessible to anyone with basic command-line knowledge. The device's firmware v3.0.0.4662_2503122283 is confirmed vulnerable, and no patched version has been released.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely lacks rate limiting or authentication checks in the RTMP server's stream acceptance logic. A patched version would need to implement:

• Rate limiting on incoming RTMP push requests.
• Authentication tokens or IP whitelisting for stream sources.
• Resource monitoring to drop excessive connections.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can use ffmpeg to push multiple streams to the doorbell's RTMP endpoint. The following command can be used to initiate a single stream push:

ffmpeg -re -i /dev/zero -c copy -f flv rtmp://<target_ip>/live/stream

To cause a DoS, the attacker can run multiple instances in parallel:

for i in {1..100}; do
  ffmpeg -re -i /dev/zero -c copy -f flv rtmp://<target_ip>/live/stream$i &
done

This will overwhelm the device. The attacker can also use tools like parallel or xargs for more efficient execution.

Blue Team

To detect and mitigate this attack:

• Monitor network traffic for a high volume of RTMP push requests from a single IP.
• Implement rate limiting on the RTMP server using firewall rules or a reverse proxy.
• Use intrusion detection systems (IDS) to alert on multiple ffmpeg connections.
• Isolate IoT devices on a separate VLAN with strict access controls.

Indicators of Compromise (IOCs)

• Network: High volume of RTMP push requests (port 1935) from a single source IP.
• Logs: Device logs showing repeated "RTMP push accepted" messages.
• Behavior: Doorbell becomes unresponsive, video stream fails, and device reboots or hangs.
• File: Presence of ffmpeg processes on attacker machine pushing to the target.

Detection Engineering

YARA Rule

rule CVE_2025_55634_Reolink_RTMP_DoS {
  meta:
    description = "Detects ffmpeg-based RTMP push attempts targeting Reolink doorbells"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-55634"
  strings:
    $ffmpeg = "ffmpeg" nocase
    $rtmp = "rtmp://" nocase
    $reolink = "Reolink" nocase
  condition:
    $ffmpeg and $rtmp and $reolink
}

Sigma Rule

title: Reolink RTMP DoS Attack Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects multiple RTMP push connections from a single source to a Reolink doorbell
author: Valters IT
logsource:
  category: network_connection
  product: suricata
detection:
  selection:
    dest_port: 1935
    app_protocol: rtmp
    event_type: alert
  condition: selection
falsepositives:
  - Legitimate multiple stream pushes from authorized sources
level: high

Suricata Rule

alert tcp any any -> any 1935 (msg:"CVE-2025-55634 Reolink RTMP DoS Attempt"; flow:to_server; content:"|52 54 4d 50|"; nocase; threshold: type both, track by_src, count 10, seconds 1; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the RTMP server if not needed, or restrict access to trusted IPs via firewall.
• Network: Place the doorbell on a separate VLAN with no direct internet exposure.
• Firmware: Monitor Reolink for a patched firmware version and apply it as soon as available.
• Monitoring: Implement network monitoring to detect abnormal RTMP traffic patterns.
• Workaround: Use a reverse proxy with rate limiting in front of the RTMP server.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert